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herewith the PY 1973 Annual Report of the Office of Security. 
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OFFICE OF SECURITY ANNUAL REPORT 


SECTION I. 6EKERAL 

During FY 1973 the Personnel Security Division had the 
responsibility within the Office of Security to process 
security clearances of individuals for overt and semi -covert 
utilization by the Agency and to assist these employees in a 
broad spectrum of security areas by providing guidance as 
required or requested. The Personnel Security Division 
receives its requests for security clearance action fro® other 
components ; e.g* , the Office of Personnel, the h 5ft v 

logistics* and the Deputy Directorate for Science and Technology, 

Toward the end of FY 1973* i.e. , mid Nay to the 30th 
of dune 1973. the Personnel Security Division was heavily 
committed to the accomplishment of a large volume of termina- 
tion security processings brought about by jbe A£ene> 3 ^ajor- 
reduction in force and a large number of voluntary retirements. 
Over 700 of these interviews were conducted over the period 
11 June to 30 June 1973. A Task Force team of ten professional 

personnel were assigned to these debriefing duties nrnilei 
regular assignment in the Personnel Security Division appraisal 
function. In addition, 211 EOD»«I summer employees were 
afforded personal interviews regarding their security respon 
sibilitles, policy on drug abuse, and other 
matters. During the latter portion of FY 1973, planning was 
directed to the orderly implementation of a major reorganization 
within the Office of Security. 

The Interrogation Research Division was assigned the 
mission of obtaining information through the security inter- 
view and polygraph examination technique for «je by those 
officials charged with making security and suitability decisions 
on candidates for employment in or use by the Agency. 

The overall mission of the Division during FY J973 
remained as a service support activity responding to requests 
from other Agency components both domestically and world- 
wide. It is a continuing effort on the part of the Division 
to strive for improvement in the interrogation techniques 
and polygraph chart interpretation and to maintain our foreign 
language capabilities. 
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The Security Records Division (SRD) is a service 
activity. It provides current and long-range support to 
the Office of Security through the development, management , 
utilisation, and protection of security records. It operates 
several Automatic Data Processing Systems in coordination 
with other components in the Office of Security and the Agency. 
Complete and current records and indices of security infor- 
mation on personnel and organisations of interest te the Agency 
are maintained. Liaison is provided with other U.5. Government 
agencies for the release of personnel security information. 

All Top Secret and Restricted Data material within the Office 
of Security is controlled hy SRD. It maintains a central 
data bate covering leaks ef intelligence information to public 
information media. It operates a secure teletype communi- 
cations system betweon the Offi ce ef Security Headquarters 
1 and the I L The SRD maintains a master 

index for the Intelligence Community of persons in the U.S. 
Government and private industry approved for access to sensitive 
end compart men ted Intelligence. This index is automated and 
updated daily for the use of the Intelligence Community. 

Although operating tinder n T/0 of staff 25X1 

positions, a chronic vacancy situation 4 positions 

persisted throughout the year. Recruitment to fill theso 
vacancies must be e factor beyond the control of tho Agency 
or the vacancy problem would not have persisted throughout 
FT 1975. Similarly, while a microfiche camera and equipment 
were received on 6 November 1972 with the first filming of 
security files by SRD personnel taking place on 14 November, 
the program has been hampered by a lack of personnel. One 
professional was assigned to the microfiche project from 
within the Office of Security but outside ef SRD on 51 July 1972 
on an ever- strength basis end two clerical employees were 
detailed from within SRD to eealst his. While the SRD Personnel 
Allocation in FY 1974 is to be reduced to olghty-five positions, 
s pending reorganization of the Office ef Security will result 
in an increase te ninety-four positions. Six of the new 
positions will be assigned to the microfiche project which 
will be carried out by a new Microfiche and Retirement Branch 
composed ef twelve positions. 

Two factors are impacting on tho SRD objective to 
replace existing manual controls and reporting activities 
associated with case processing procedures In the Office of 
Security with e fully operational automated CAPER- OS System 
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within tli# Manpower Control System. The implementation of 
Stags I of CAPER-OS had to be moved back from 18 June 1975 
to 7 September 1975 by the SIPS Task Force due to technical 
problems. A pending reorganisation of the Office of Security; 
by which disparate functions are to be consolidated will 
necessitate modifications in the CAPER-OS programming. This 
will further delay the implementation of Stage I of CAPER-05. 


The mission of the Overseas Security Support Division 
(OSSD) is to establish and implement a security program to 
ensure maximum security for Agency facilities and assets at 
all overseas installations. Excepted from this mission is 
responsibility for audiocountermeasures which is in the 
exclusive purview of the Technical Division. 


The mission is accomplished primarily through the tech- 
nique of comprehensive security surveys. Each overseas 
installation is visited is accordance with a predetermined 
schedule concomitant with gensral requirements established by 
the DDO and with due consideration for US IB directives 
applicable to the intelligence community as a whole. 


During the report period, two significant events causey 
some adjustment in priorities and approach to fulfilling the 
mission* The first event involved the transfer of all security 
equipment specialists fro© the Division to the Physical 
Security Division. This resulted in the requirement for OSSD 
to continue with cognizance over all equipment service 
requests by levying requirements on the Physical Security 
Division which controlled the manpower assets. The second 
event which impacted upon the Division was the advent of the 
increased threat of terrorist groups and their activities 
particularly in the Middle East. 


The transfer of security equipment specialists as a 
group, coupled with the normal annual manpower turnover, 
resulted in the departure of ten officer personnel from the 
Division and the arrival of four new officers. This change 
of personnel did not significantly affoct the accompli shaent 


of tho Division* s objectives, but its impact will be more 


significant during the early stages of FY 1974. 1 

perienced officers will require training during which time 
they will be relatively unproductive. The time consumed by 
OSSD officers performing the training will further impact upon 
productivity goals. 
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The Office of Security has had a discrete program activity 
in the computer security field since 1917. Since that time 
with the growth of computer applications and usage in the 
Agency anti in the Intelligence Community , this program has 
steadily grown. The requirements for security support and 

S idance In the information handling area are continuing to 
crease; this trend Is not expected te change through FY 1976, 
and there are no current indications that requirements will 
taper off even at that tine. During FT 1973 the information 
handling security program is considered to hare "come of age 
in that its activities and accomplishments changed from a 
missionary effort to an accopted dimension of overall security 
operations. 

The growth in security requirements in the information 
handling area hat been not only in quantitative terms with 
the increase of computer applications and computer capacity, 
but has also continued te become more complex. During FY 1973 
the complexity of those requirements was highlighted by 
(a) initial planning for the OJCS Maas Storage System, (b) a 
greater impetus to the networking of computer systems both in 
the Agency and the Community, and (c) the development of 
substantial evidence of vulnerability in computer operating 
systems. The latter two are paradoxical insofar as simul- 
taneously computer system requirements are becoming multi- 
dimensional with the growth of networks and the threat of 
intrusion is becoming more evident. This paradox supports the 
need for increasing attention in the computer security area. 

In the current period of decrementation and limited resources, 
these ever growing requirements were the basis for examining 
our computer security program during FY 1973 to organise it 
along goal-oriented objectives. This reorganisation of the 

g rogrsm was implemented early in FY 1974 and will form the 
asls for a valid evaluation of lta progress in the coming yoar. 
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In FY 1975 the decision of the winter of 1971 to establish 
on in-house security alarm and electronic capability began 
to bear fruit. For a sun roughly equivalent to the amount 
being paid a private contractor to Maintain the Headquarters 
a lam systems, two electronic engineers and three electronic 
technicians were hired on a contract basis. As a result, 
security alarm installation. Maintenance, and repair at 
Headquarters has improved by st least a factor of two with a 
very substantial fallout to the other electronic programs of 
the branch. Additionally, almost one full nan year of support 
overseas to the Overseas Security Support and Technical 
Divisions was provided by the Physical Security Division. 

The Safety Staff, in accordance with established Agency 
regulations, is responsible for formulating and recommending 
to the Director of Security policies and practices for an 
effactive safety program. The program must be conducted in 
accordance with the Occupational Safety end Health Act ef 
1970 and Executive Order 11612, which defined the expected 
participation of each Federal agency. In an attempt te conduct 
an affective Agency Safety Program, certain of the activities 
were placed into subprograms. This was done to effect better 
manager on t and to analyse the shortcomings and successes ef 
the overall program. Ono of the greatest problems is the 
demand placed by other components to service then on a daily 
basis. Although such demands are met, the other subprograms 
are seriously affected. 

The Invest iget lens and Operational Support Directorate 
CIOS) assists with the preparation and execution of the Agency 
security program insofar as it relates to the fields ef 
Investigation and I I support of Agency covert 

operations. It is directly responsible for planning and 
implementing the investigations and operational support pro* 
grams through the administration and direction of the Office 


The objectives for IOS, that is, to maintain a viable 
investigative capability to support the Personnel Security 
Program (under EO 1045© and DCID 1/141 g to support the 25X1 

Clandestine Service (under l and te fully sustain a 

program ef operational support encompassing all major Agency 
elements, continued to be maintained during FY 1973 with fewer 
available personnel without decreasing the quality ef the product. 
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Problem areas continue to confront the investigator in 
the field on a daily basis. These areas are the effect of 
’'Invasion of Privacy"; the increased resistance to release 
information in the educational, credit, and legal areas; and 
the increased difficulty of aebility within the cosnmnity. 
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SECTION II. ACCOMPLISHMENTS 


a. Objective 1 (OS) 

(1) The Personnel Security Division will process 
approximately 2200 applicant cases involving field investi- 
gations and 7392 cases involving name checks only. 

(2) Action Plan 

Process approximately 550 field and 1850 name 
check cases by 30 September 1972, 31 December 1972, 30 March 
1973, and 30 June 1973. 

(3) Progress and Shortfall 

Full accomplishment was achieved despite the 
fact that there was a 14.41 increase over FY 1972 in the number 
of cases security disapproved. 

(4) Problems 

Processing of security disapproval cases involves 
comprehensive summary write-ups and evaluation memoranda. The 
greater the number of disapprovals, the more appraisal workload 
time is required. 

(5) Future Plans 

Under the reorganization, applicant type cases 
will continue to be processed. However, the investigative/ 
appraisal functions will be consolidated, thus eliminating 
duplication. 

(6) Costs 

51,1 man years or $1,018,700. 

b. Objective 2 (OS) 

(1) Service requests for 1900 polygraph examinations 
originating in Office of Personnel and other overt sources. 
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(2) Action Plan 

Conduct approxiaately 47S examination* by 
30 September 1972, SI December 1972, 30 March 1973, and 30 
June 1073. 

(3) Progress and Shortfall 

Our goals in the Interrogation Division are 
primarily to improve the quality of our polygraph interrogation 
performance to the complete satisfaction of the consumer, he 
evaluate our results by the success of our finished 
An interrogation is a success when significant information it 
obtained that was previously unobtainable by other investigatory 
methods ox when an evaluation Is made that a pelyg**P il 
has no meaningful information to contribute and has been truth- 
ful during interrogation. 

During FY 1973 a total of 1944 polygraph .... 
examinations were conducted on cases originating in the Office 
of Personnel and other overt sources. From this total , 745 
reports were produced containing significant information* 

(4) Problems 

A reduction of the number of available examiners 
towards the latter half of FY 1973 was experienced as a result 
of the unexpected retirement of senior personnel and , 

surplus ing of three examiners. This reduction necessitated 
a rearrangement of priorities , particularly in our *•*’ jibing 

During FY 1973 one new man was 
recruited ana trained, a process which involved the full ti* 3 ® 
of our Training and Research Officer for a period of two months. 
The new trainee is still in an apprentice status after six 
months. The Division cannot replace retired or surplus ed 
personnel by recruitment of new men without allowing i« * 
loss of manpower for a period of three to six months while 
training and monitor inc of the new man proceeds* Further 
reductions in manpower at this time would seriously impair our 
ability to service domestic requests on a timely basis. 

(5) Future Plans 

Continue to provide polygraph support in response 
to requests from the Office of Personnel and other overt sources 
on a timely basis. 
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(6) Costs 

8 mas years or $159,483, 


c. Objective 3 (OS) 




(2) Action Plan 

Conduct approximately S$ examinations by 30 
September 1972, 31 December 1972, 30 March 1973, and 30 June 
1973. 

(3) Progress and Shortfall 

During n 1973 progress towards our goal in 
conducting an estimated 3S0 cases was considerably exceeded 
as reflected in the statistical summary below: 
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d. Objective 4 (OS) 

(1) Conduct research towards improvement of the 
polygraph technique and Instrumentation. 

(2) Action Flan 

Assist OR9/BD/S5T in polygraph related research 
and bring to ORB attention areas of potential research. Evaluate 
developments and studies In lie detection by other government 
agencies, private and foreign organizations. 
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(&) Costs 

During PY 1973 our research related costs 
case to approximately $3,000. This included three trips to 
California for two wen plus mileage for Research Officer 
activities in the greater Washington, D.C. , area. Total 
manpower Involved would approximate one man year. 


e. Objective 5 (OS) 


(1) By utilising and reorganizing existing manpower 
and funding levels, complete by 31 March 1974, the process 

of replacing existing manual controls and reporting activities 
associated with case processing procedures in the Office of 
Security with a fully operational automated CAPER -OS System. 

(2) Action Plan 

9 duly 1975 - Conduct one week course for 
Cathode Ray Tube (Ckf)’ terminal operators. 

13 July 1973 - Distribute Procedure Handbooks 
for processing “points^ 


furniture. 


16 July 1973 - Install terminal equipment and 


18 July 1973 - Brief and train professional and 
supporting clerical personnel , 


data) 


30 July 1973 * Train terminal equipment operators, 
6 August 1973 - Test CAPER -OS Syste© (with test 


7 September 1975 - Implement Stage I - the 
parallel operation of manual and automated case processing systems 
for all overt and overt miscellaneous type security clearance 
actions. 

(3) Progress and Shortfall 

The Action Plan for Objective 5 was amended 
after the Director of Security was advised by the Director, 

SIPS Task Force on 27 March 1973 that the implementation date 
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for Stage 1 of CAPER- OS had to be delayed fro® 18 June to 7 
September 1973 due to technical problem*. The first chrono- 
logical benchmark was moved back from 16 April 1973 to 9 July 
1973 as a result. 

(4) Problems 

A further delay in implementing the Action Plan 
will occur because of the reorganisation of the Office of 
Security. Under this reorganisation, disparate functions are 
to be consolidated in a way that will necessitate modifications 

in the CAPER-OS program. 

(5) Future Plans 

These are dependent on a new look at the program 
after the reorganisation. 

(6} Costs 

$0 


f. Objective 6 (OS) 

(1) By utilising and reorganising existing manpower 
and funding levels, achieve a net sere growth by 30 June 1975 
in the Office of Security holdings at the Agency’s Records 
Center. 

(2) Action Plan 

Purchase a microfiche camera and equipment 
during November 1972. Process approximately 4500 files by 
SO June 1973. 

(3) Progress and Shortfall 

Progress was made during the period in terms 
of milestones passed and action completed. Substantial progress 
in the future is expected as additional personnel are trained 
and assigned to this program* By the end of 30 June 1975, it 
is expected that wt will be processing at the rate of 20,000 
cases per year. This will mean a net aero growth by the Office 
of Security at the Agency’s Records Center. 
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(4) Problems 

during the initial period, the microfiche 
program was hampered not only by a lack of personnel but by 
the necessity of assigning untrained personnel to the program, 
thus requiring an extensive period of on-the-job training. 

(5) Future Plans 

oith the purchase of a second microfiche camera 
during Ft 1975, the Office of Security will reduce its holdings 
at the Records Center at a rate of approximately 20,000 files 
per year. 


(6) Costs 


Three man years, plus $24,690 for microfiche 
camera and equipment. 


g. Objective 7 (OS) 

(1) To better utilise the 60S0 square feet of space 
dedicated to open file shelving by replacing fifteen double- 
faced ranges occupying an area of 2213 square feet of this 
space with mobile shelving, realising an increase in file 
storage capacity of 941 in this area. 

(2) Action Plan 

A request for funds to procure mobile shelving 
was made in the FY 1973-1977 Program Call submission, and the 
availability of such funding in the FY 1973 budget was certified 
on 3 October 1972. An approval to purchase the mobile shelving 
was granted on 27 October 1972 by the Chief, Support Services 
Staff, Support Directorate. A "Requisition for Material 
and/or Services*' was issued on 20 November 1972 to eight 
corporations manufacturing and installing automated shelving. 
Rids were submitted by six of these vendors. A bid was 
selected 9 March 1973 and the resulting contract called for 
delivery and installation of the mobile shelving to be 
completed by £ August 1973. 

(3) Progress and Shortfall 

The bid of the I 

[ was accepted 9 March 1973 because their 
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equipment would wore than double the linear feet of available 
•helving, an increase of 1021 from 4320 linear feet to 0736 
linear feet and 41 more than required in t he Agency *s criteri a 
on which the bid was based. Moreover, the I I 25X1 

made an allowance of $3,202 for existing shelving for a net 
cost of $52,720 for the mobile shelving. An amendment to the 
contract was made to include an additional $8,736 for lighting. 

Since funds in the amount of $72,000 had been earmarked in the 
FT 1073 Budget for the mobile shelving, an amount of $10,544 
was made available for othe r purposes as a result of the contract 

25X1 the It is anticipated that the mobile 

shelving will be installed and in operation by 20 August 1073. 

(4) Problems 
Hone 

(5) Future Plans 

Complete installation by 1 September 1073, 

(6) Costs 
$61,456 


h. Objective S (OS) 

(1) Maintain a program of comprehensive security 
surveys of all overseas stations and bases with a visitation 
rate at each facility of not less than once every twenty- four 
months. 

(2) Action Plan 

Complete fourteen surveys by 30 September 1072, 
31 December 1972, 30 March 1973, and 30 June 1973; a total of 
fifty-six surveys during FT 1973* 

(3) Progress and Shortfall 

The goal of the objective was exceeded by three. 
A total of fifty-nine security surveys were completed during 
the year. 
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(4) Problems 

Hone 

(5) Future Plans 

To survey each overseas installation appro*!* 
stately every eighteen months with no appreciable increase in 
staffing, but rather by developing a new systea of conducting 
surveys and preparing the reports. 

(6) Costs 

6.5 nan years (survey and report writing), 
$32,000 (travel costs only). 

i. Objective 9 (OS) 

(1) To maintain, repair, and install security equip* 
sent and devices as required at overseas stations and bases. 


(2) Action Flan 

Visit a total of 
during FY 1973; approximately f 


stations and bases 

per quarter. 


25X1 

25X1 


(3) Progress and Shortfall 


The goal of this objective was met in that 

25X1 installations were visited. 491 safes were inspected 

iot evidence of surreptitious entry and provided preventive 
maintenance; sixty-one vault doors were inspected; twenty- five 
new alarms were Installed; twenty-four existing alarm systems 
were serviced; I 1 * * * * *" J ‘ I 

25X1 I I were installed; six safe cabinet lockouts were 

serviced; and inspections of forty-seven miscellaneous devices - 
key locks, etc., were completed. 

(4) Problems 
None 

(5) Future Plans 

To Initiate a program to serialise each individual 
piece of safekeeping storage equipment in use at overseas 


25X1 
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installations to ensure more adequate control of its use, 
maintenance, repair, and final disposition. 

(6) Costs 

4.70 nan years; $23,000 (exclusive of travel 
funds expended by DDO Bivisions for which emergency service 
was provided). 

J. Objective 10 (OS) 

(1) develop suitable courses and provide training 
in appropriate aspects of overseas security for new survey 
officers, support officers, and selected DBO personnel destined 
for overseas assignments. 

(2) Action Plan 

Combine classroom training and security survey 
work with on-the-job training for new survey officers by 30 
June 1973. Expend participation in Agancy training courses 
attended by support officers. 

(3) Progress end Shortfall 

A one-week Security Survey Course was conducted 
in the spring of 1973 for twelve security officers being 
assigned overseas or assigned to 055D. One now survey officer 
accompanied a sealer survey officer on n trip whore the new 
officer was trained on throe successive station surveys. A 
senior survey officer was made available to lecture students 
at the Field Administration Course conducted for support 
officers destined for overseas assignments. 

(4) Problems 

The on-the-job training technique is excellent 
and a most productive system, but is quite time consuming* 

(5) Future Plans 

Expand the Security Survey Course to two weeks 
and, time permitting, run the ceurse twice annually. Provide 
the three new security officers to bo assigned to OSS© on-the- 
job training under the direction of n senior survey officer. 
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(6) Costs 

.10 man years ; $1,813 (this figure is already 
included in the cost figure for surveys noted under Objective 


k. Objective 11 (OS) 

(1) Expand the use of presently available non* 
polluting devices for routine destruction of classified 
materials and encourage further efforts to develop additional 
such devices. 


(2) Action Plan 



25X1 


(5) Future Flans 

Ensure that every effort is wade during surveys 
to educate personnel overseas to the advantages of nonpolluting 
devices for the destruction of classified material both 
routinely and under emergency conditions. 

(6) Costs 

.05 man years. 
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y. Objective 25 (DD/MftS) 

(1) To brief the Agency personnel assigned to over- 
seas on the Hostile Audio Surveillance Threat, as well as 
provide briefings to personnel in Mid-Career Courses and 
others as requested, 

(2) Action Plan 

To provide weekly briefings to Agency personnel 
assigned to overseas stations and bases. To provide other 
briefings as requested. 
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(3) Progress and Shortfall 

Fully accomplished. During the FY 1073 period, 
briefings on the HAS threat were furnished to 3650 personnel 
in 149 briefings given on a weekly basis and eleven briefings 
were afforded 34$ personnel from other agencies. 

(4) Problems 

Minimal problems were encountered in the conduct 
of this program during the year. However, on certain occasions 
it was necessary to give special briefings due to the time 
frame limitations of the availability of the persons to be 
briefed. 

(5) Future Plans 

In FY 1974 this effort will be continued to 
assure a proper understanding to the potential threat. 

(6) Costs 

The Briefing Program expended a total of two 
man years and $9,000 in the accomplishment of the objective. 


z. Objective U (DD/MSS) 

25X1 
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aa. Objective 27 (DCI) 

(1) Enhance the effectiveness of the information 
handling security program by improving program management and 
specifically by conducting a review of Agency and Community 
requirements in the computer security area and designing a 
goal -oriented program to meet these requirements with minimal 
increase in resource allocation. 

(2) Action Plan 

This objective encompasses the program elements 
of program development , activity reporting, program review 
and evaluation, and personnel administration and training. 
During the second half of FT 1973, a study of computer security 
support requirements for the Agency and the Intelligence 
Community was planned as a basis for organising the Infor- 
mation Handling Security Program along goal-oriented lines and 
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to adjust resource allocation and organizational positioning 
to bettor moot these requirements. 

(3) Progress and Shortfall 

As planned, a thorough review of information 
handling security requirements was completed in the third 
quarter of FI 1973. During the fourth quarter a reorganization 
of manpower allocations to the program was developed which was 
implemented early in FY 1974 as part of the Office of Security 
reorganization. The results of the reorganization included 
the assignment of two additional positions to the program, 
raising the activity from branch level to division level 
component of the Office. Further, as reflected in this report, 
program activities were organized under seven program categories, 
each with a defined objective, action plan, and milestones. 

It was recognized that the increase of only two positions in 
program resource allocation was somewhat less than what the 
priority of program goals might support; however, the current 
era of decrementation and ’’tight*' programming dictated such an 
approach. 

(4) Problems 

Hone 

(5) Future Plans 

The action plan for the program developed early 
in the third quarter of FY 1973 ha# required subsequent 
modification due to the limitation on manpower ana dollar 
resources for the program identified later in the programming 
cycle. A revised action plan detailing the projected activities 
within the program has recently been completed; this revise 2 
plan particularly limits earlier hopes of testing and evaluating 
the security of all major Agency computer systems by FY 197S. 

As an alternative, testing and evaluation efforts will be 
highly selective and accent the highest priorities. 

(6) Costs 

During FY 1973, .75 ©an year was expended on 
this program objective. 
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bb. Objective 28 (DCI) 

(1) Develop Agency security policy and standards 
referent to computer processing and storage of official data. 

(2) Action Plan 

Accomplishment of this objective is a continuing 
activity of developing in timely fashion policy and standards 
for the Agency to insure the protection of official data 
involved in computer operations. It encompasses not only the 
development of new policy but also periodic review of estab- 
lished policy and standards to assess their continuing 
effectiveness. During FY 1975 promulgation of a Headquarters 
Notice concerning the classification of computer output 
material was planned. Further, Agency policy concerning the 
sanitization of computer storage media, security standards 
for remote termin al installations, and a revised Headquarters 
25X1 Regulation I I concerning accountability for classified 
material were programmed for initial development* Finally, 
development of Data Distribution Security Standards for 
buildings other than Headquarters was expected. 

(3) Progress and Shortfall 

As programmed, H» [ 1 was developed and 25X1 

promulgated establishing Agency policy for the classification 
of computer output material. Preliminary drafts of proposed 
security policy on the sanitization of computer storage media 
and the installation of remote te rminal s have been prepared. 

An initial draft of a revised HR I I has been written* 25X1 

Development of Data Distribution Standards for other than 
Headquarters building has not been accomplished and is now 
programmed for FY 1974* 

(4) Problems 

In the past, difficulty has been encountered 
in coordinating security policy in the information handling 
field, in large measure due to the compromise approach to 
policy development in the Agency. Establishment of the 
Management and Services Directorate in the last half of FY 
1975 has suggested that policy development activities will 
take a more positive approach, and promulgation of regulatory 
issuances in the future are expected to be facilitated. 


-56 


Approved For Release 2002/«CWfHaiA-RDP83B00823R000400070001-6 





Approved ForAease 2002/08/^Qj{££ DP83B0082^00400070001-6 


(5) Future Plant 

In addition to completing development of policy 
items already mentioned* during FY 1974 the initial preparation 
of a Headquarters Handbook on computer security is programmed. 
Further, during FY 1974 a review of Headquarters Data distri- 
bution Security Standards is expected. 

(b) Costs 

During FY 1973 an estimated .5 man year was 
expended on computer security policy development. 


cc. Objective 29 (DCI) 

(1) Provide guidance and support to Agency compo- 
nents and contractors to ensure protection of official data 
stored and processed by computers. 

(2) Action Plan 

The action plan related to the objective 
encompasses both continuing and discrete activities. On s 
continuing basis guidance and support is rendered to sll 
Agency components involved in computer operations; this 
support includes not only Headquarters components but contractor 
sites whose security is under the cognisance of staffs in the 
Office of Logistics and the BD/$«T. Also on a continuing 
basis, the functions of Information Systems Security Officer 
with reference to DCIB No. 1/lb and Distribution Systems 
Security Officer under the provisions of the Headquarters Bata 
Grid Standards are performed ms part of the information 
handling security program. Further, computer security briefings 
and training sessions are provided to Agency personnel and 
components on a regular basis as part of OJCS training courses 
and on a periodic basis on special requests. 

Discrete projects which are encompassed under 
this objective Included security support to the development 
of the OJCS Mass Storage System, the OC Cable Dissemination 
System, the plans to network Headquarters computers, and the 
development and operation of security audit systems. 

Although most program elements falling under 
this objective call for continuous, periodic or aperiodic 
support, a limited number of activities were specifically 
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planned for FY 1973. Among these discrete activities was 
a study to identify according to vulnerability priority 
deficiencies in Headquarters data distribution lines installed 
prior to the Grid System, the development of a design for a 
security audit system for the CJCS Interactive System, 
participation in an Agency-wide effort to identify future 
computer terminal requirements and associated problems, and 
security support to the development of the Mass storage system. 


(3) Progress and Shortfall 

Performance in the guidance and support area 
during FY 1973 met or exceeded expectations. Hot only was 
security support rendered to Agency components and contractors, 
but the Information Handling Security Program was able to 
provide special support to OJCS in furnishing full-time bach 
up for the second half of the Fiscal Year to the OJCS Security 
Officer* A security Audit System was designed for the OJCS 
Interactive System which is expected to be implemented early 
in FY 1974. As planned, the security deficiencies in Heed- 
quarters data distribution lines were identified, ranked 
according to priority, and provided to the Office of Communi- 
cations who has already begun to correct deficiencies. In 
the development of specifications for the Mass ^torage system, 
security participation was present from the beginning and 
should serve to enhance the security of that system upon 
delivery in FY 1974 and FY 1975, This in itself was signifi- 
cant in that security became a design goal in the development 
of the system from the very beginning. 


{4) Problems 
Kone 


(5) Future Plans 

Guidance and support to Agency components and 
contractors will be continuing; computer security briefings of 
Agency personnel and components will continue as required; 
during FY 1974 reactivation of a computer security seminar 
for selected Agency employees is expected. 


(6) Costs 

During FY 1973 it is estimated that 1.5 man 
years was expended toward this objective. 
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dd. Objective SO (OCX) 

(1) Conduct inspection of Agency computer operations 
and analytical testing of Agency systems to evaluate the 
security of such systems and operations as a oasis for tnexr 
security certification* 

(2) Action Plan 

Accomplishment of this objective encompassed 
two distinct types of activities: inspection of Agency and 
contractor computer facilities and procedures? snu the security 
analysis, testing and evaluation of computer systems and 
operations* The former of those two types of activities 
includes the security inspection of proposed terminal sites 
as well as the survey of computer installations and procedures. 
The latter testing and evaluation effort usually entails a 
comprehensive analysis of the security aspects of computer 
operations including the effectiveness of system hardware 
and software. 


During FT 1973 the number of remote terminal 
inspections could not be anticipated; however, it was expected 
that this number would surpass such requirements in any 
previous year. It was planned that accomplishment of the 
necessary remote terminal inspections would be done for this 
greater number of terminal installations and at the same time 
ensure that inspection actions would be completed in other 
than unusual cases in less than twenty-one days from receipt 
of the inspection request. Programmed in the latter half of 
FY 1973 was a security survey of the ORB computer center. 


Also during the first half of FY 1973, a 
comprehensive analysis, testing and evaluation of the OJCS 
Interactive System was programmed for completion. A second 
security analysis, testing and evaluation of an OJCS system 
was scheduled to be initiated in the fourth quarter of FT 1973, 
viz., software analysis and evaluation of the GIM-Il Bata 
Management System associated with the Support Information 
Processing System (SIPS). 


(3) Progress and Shortfall 

During FY 1973 a total of seventy-four remote 
terminal installations were surveyed and approved for operation; 
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tlM twenty-one day action schedule was normally *ef : * 
planned survey of the ORB computer center woo accomplished on 
schedule. The analysis, test and evaluation of the OJCS 
Interactive System was completed in January W73. The expected 
initiation of the GIM-II software security analysis has been 
indefinitely delayed due to the lack of sufficlont documea- 
tatiem and the continuing instability of the ays t or. 

The Interactive System test represented a 
significant accomplishment not only for tho results received 
in identifying software vulnerabilities in the system, but 
also for the experience gained in developing workable 
methodology for the security test and evaluation of large- 
scale systems. 

(4) Problems 

.None 

(5) Future Plans 

Initial security inspections of proposed remote 
terminal operations will continue. During FY 1974 a program 
of reaurveyittg on an annual basis Headquarters area remote 
terminal sites will be initiated. Attempts are being made to 
dove lop procedures to conduct sft or- hours chocks of remote 
terminal sites to ensure that such terminal* are P^®P*Tly 
disconnected from their parent computer system or disabled, 
such as to deny illicit attempts at remote terminal access. 

If sufficient progress occurs in tho stabilisation of the 
GIM-II system and adequate documentation is produced, the 
software analysis and evaluation of the system will be re- 
considered late in FY 1974. During FY 1974 and early FY 1975 
s survey of MPIC computer operations and system security 
analysis and testing of KPIC computer systems is planned. 
Vulnerability analysis and testing of the Mass Storage System 
is expected after its delivery during FY 1975. Conduct of a 
softwaro tost of OJCS network operations is contemplated tor 
FY 1976. 

(6) Costs 

An estimated 1.75 man years of effort was 
expended on this objective during FY 1975. In addition, 
contractor support for the software testing of the Qjcs 
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Interactive System cost slightly over $60 these funds 
wore allocs tod from the FY 1071 budget and represented an 
approx lnate $0,000 underrun. $160,000 programmed in FY 1973 
for the GIM-II test was returned to the Directorate when the 
teat delay was identified. 


ee. Objective 31 (PCI) 

(1) Identify and coordinate the development of 
solutions to administrative and technical problems associated 
with the security of Agency information handling operations. 

(2) Action Plan 

It is important to distinguish this objective 
fron routine guidance activities falling under Objective 29, 
above. The instant objective addressing problem resolution 
bespeaks activities associated with generic computer security 
problems, i.e, , Issues of Agencywide interest. Among 
program elements under tblo objective are the development and 
Implementation of a concept and standards for the security 
labeling of computor stored data, the development of security 
measurement units to pemit tho application of quantitative 
methods to computer security assessment activities, the 
daveionraftat of methodology and techniques to astect the 


25X1 


review of the remote terminal monitor concept with a view 
toward its improvement or replacement by ether producers was 
planned. All other program elements under this objective^ 
were programmed for FY 1674 or for only Initial thinking in 
FY 1973 with broader development thereafter. 

(5) Progress and Shortfall 

No measure of progress In this ares was antici- 
patad during FY 1973 except for the review of the remote 
terminal monitor concept. This review was accomplished as 
part of the Interactive System test, but identificatiom of 
improved options to replace this concept bnve not been Identified. 

(4) Problems 

Difficulties associated with this abjective are 
complex and in large measure are dependent on expensive research 
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and development. In addition, resolution of nany 
problems associated with computer security is inhibited by 
the limited number of individuals fcmowledgeeble in this area. 
It Is expected that attempts will be made to identify within 
the information handling security program a focal point for 
the definition and coordination of Agency computer security 
RID requirements. With the establishment of such s focal 
point .requirements in this area can be defined tow.t Agency 
needs as a whole and levied upon the DD/SIT for fulfillment. 

(5) Future Plans 

Program elements in the problem resolution area 
remain ea identified above. Specific progress is envisioned 
during FY 1974 in the development of e concept of labeling 
computer' stored date according to its security sensitivity, 
the development of a concept of security measurement units, 
t.hm tamrovcTaAnt of terminal access control techniques, and 


25X1 


significant progress is not foreseen before ft i»/>. 

(6) Costs 

During FY 1973 approximately .5 man year was 
expended toward this objective. 

ff. Objective 32 (PCI) 

(1) Provide leadership and support to tho Intelligence 
Community in addressing computer security issues of inter- 
Agency concern through the USIB structure as well as assistance 
to overall Government and non- Government efforts involved in 
the development of technology in the computer security field. 

(2) Action Plan 

Accomplishment of this objective includes both 
continuing efforts and discrete projects. The principal 
program element under this objective is the direction and 
staff support of the USIB Computer Security Subcommittee. 

During FY 1973 within the Computer Security Subcommittee structure 
the development of a computer media sanitisatio n policy and of 
an initial outline of a comprehensive Intelligence Community 
computer security policy document were scheduled. In addition. 
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at the request of another USIB committee, the Subcommittee 
wet tasked to analyse the security issue involved in upgrading 
the security level of the Community On-Line Intelligence 
System (COINS) . 

Also included in our external support program 
category are continuing liaison support efforts to other 
Government agencies, notably the National Bureau of Standards, 
the Office of the Secrotary of Defense, the U.S. Communications 
Security Board, and uon-Goveramont computer security efforts 
of mutual concern. A major program element is Agency support 
of the COINS Security Panel. In the liaison support area, a 
significant project during th© second half of FY 1973 was the 
focusing o f Intelligenc e Community and other Government 
25X1 support of I I with refere nce to its performance of 

25X1 a contract from I I Our support of this contract 

was predicated on a declaration from the Office of Management 
and Budget to assist development of technology in the computer 
security field for the public domain. Our contribution was 
oriented toward the development of improved techniques for 
the security evaluation of computer security operations, 
especially in the software field and the design of a secure 
operating system. Our action plan included support of this 
effort during the last half of FY 1973 and the first half 
of FT 1974. 

(3) Progress and Shortfall 

During FY 1973 the Computer Security Subcommittee 
was active in guiding the Security Committee in the computer 
security area. It accomplished its review of the security 
issues involved in the COINS upgrading, completed drafting a 
Community policy for the sanitixation of computer atorago media, 
and developed an outline for a comprehensive Community computer 
security policy document. These accomplishments occurred 
generally on schedule. Liaison support was highlighted by 
informal coordination with DoD on the latter* s development of 
a DoD computer security policy, performance as programmed in 
support of l L and participation and assistance to 

the National Bureau of Standards in the latter's Government- 
wide intention of establishing a coordinated effort outside the 
Intelligence Community directed at computer security problems 
of national concern. The most significant shortfall in this 
• area concerned the upgrading of the COINS Security Level, in 
that the decision to upgrade COINS was summarily mad© by the 
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Deputy to the Director for the Intelligence Community without 
the benefit of the Computer Severity Subcommittee * s assessment 
of the security issue involved. 

(4) Problems 

The shortfall Identified above referent to the 
COIKS upgrading issue may be symptomatic of a broader void in 
our support of Community computer security problems. No action 
has been taken to overcome this problem pending resolution of 
the revision of the USIB/IC Staff structure and relationship 
issue. In the long run, however, an established procedure 
must be Implemented to ensure timely computer security guidance 
in the Intelligence Community Staff decisions. 

(5) Future Plans 

Support of the j I effort will continue 25X1 

through the second quarter of FY 1974; further continuation 
of this project and our support thereto will be evaluated at 
mid FY 1974. Development of the Intelligence Community computer 
security policy document will proceed through at least the 
first half e£ FY 1974 and in view of the complex nature of this 
policy paper, its coordination within the Community may well 
extend through the fiscal year. Support of the COINS Security 
Panel will be continuing for the foreseeable future as well 
as liaison support to other Government organisations and 
agencies. Involvement in the coordination of the computer 
security annex of the National Communications Security Plan 
is anticipated in FY 1974. 

(6) Costs 

An estimated one man year of effort was expended 
toward this objective In FY 1973. 


gg. Objective 33 (PCI) 

(1) Establish an improved, less cumbersome system 
of control over Agency Top Secret material. 

(2) Action Plan 

Pursuant to the decision of the Executive 
Director-Comptroller, the Agency Top Secret control function 
was programmed for transfer from the Central Reference Service 
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to the Office of Security in March 1973. Ia the earlio* p»rt 
of the third quarter of ¥1 1973, security persoaael were 
projected for assignment to study and learn exist Ins procedures 
of the Agency Top Secret control operation, for the balance 
of FY 1973, subsequent to the Office of Security take over of 
this function, aaiatenance of the existing system was planned 
while a review of the syston wag to be accomplished with a 
view toward improving any def ieiencles , making the aystea leas 
cumbersome, and beginning the development of an upgraded Tep 
Secret control program plan which night include en automated 
central system for Top Secret material. 

(3) Progress and Shortfall 

Two individuals from the Office of Security 
began early in the third quarter ef FT If 73 on* site in the 
Central Reference Service learning the mechanics ef the 
existing Top Secret control program. On schedule in March 
197$, the Office of Security assumed the function. Shortly 
thereafter basic goals of an improved, less cumbersome control 
system were outlined end during the final quarter ef FY 1973 
this outline was developed in more detail. As indicat ed abov e 

under Objective 27, e revised Headquarters Regulation | | 25X1 

has been drafted. A survey of component level control programs 
has bean made with a view toward designing the requirements 
far en Agency -wide automated control system. Progress toward 
this objective has been completely according to plan. 

(4) Problems 

While no problems have been encountered to date 
ia this area, it is anticipated that some obstacles will 
appear during FY 1974, especially with regard te the elimination 
of established control procedures that are too cumbersome far 
some Agency components and considered vital in other areas. 

Wo specific measures to overcome these obstacles ere being 
considered since in most cesos they involve e reorientation of 
traditional thinking baaed on yoers of habit. 

(5) Future Plans 

Maintenance of the existing Top Secret control 
program is foreseen through the third quarter of FY 197** - 

during which tino the upgraded, streamlined program will be 
developed, coordinated, and approved. Full implementation of 
this upgraded program aftor a period of parallel operation is 
envisioned on 1 April 1974. 
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(6) Costs 

In FT 1973 an estimated .7$ sts year was 
expended toward this objective. 


hh. Objective 34 (OS) 

(1) To ensure that CIA has a cadre of trained 
personnel to handle installation, repair, and maintenance of 
physical security devices overseas by providing training to 
selected overseas designees. 

(2) Action Plan 

Provide two, two-week courses ef in-depth 
training to member* of the Office of Security being processed 
for PCS overseas assignment end to other Security Office 
personnel requiring highly specialized training in physical 
security devices. 

Provide a limited physical security training 
program to representatives of other Agency components including 
the Office of Communications and military assignees as 
requested. This training is offered to provide the individuals 
with the capability of recognizing the differences between 
various security equipment and provides the* with the capability 
to effect minor repairs, maintenance, and combination changes . 

Prpvi d* a familiarization program for Finance 
Officers, Admin Officers, and Logistics Officers who are being 
sent overseas and who will be required to change combinations 
and to assist in solving other Station physical security 
problems. 

Provide specialized training and briefing programs 
to representatives of other U.5. governmental agencies as 
requested. 

(3) Progress and Shortfall 

During FY 1973 twenty Security Officers were 
afforded two weeks of training in two separate sessions; in 
addition, all other training requests were met which included 
thirty representatives of other Agency components who were 
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provided with a three- day training coarse; ninety-seven 
members of Office ef Logistics , Admin Officers, end Finance 
Officers were afforded a one-day training/brlefing program; 
and thirteen personnel representing other government agencies 
were afforded in-depth training. 

(4) Problems 

Mono 

(5) Future Plans 

In regard to training, future plans include but 
are not limited to en increasing effort to improve the 
standard and quality of training through tho procurement ef 
sophisticated training aids, a continuing supply of now 
training matarial, and tha adoption and adherence to planned 
and programmed training schedules. 

(6) Costs 

Dollar costa for FY 1973 for equipment procure- 
ment, training aid and fabrication and procurement were 
$13,500. One man year. 
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(4) Problems 
None 

(5) Future Pleat 

To continue t© provide the sane quality service* 

(6) Costs 

Twelve nan years. 


oo. Objective 41 (SCI) 

(1) Provide overt and covert clearance and investi- 
gative support os a greater productivity level without a 
decrease in quality during FY 1973 than was provided in 


(2) Action Plan 

To complete a study by 30 September 1972 to 
determine ways to streamline investigative techniques and 

f rocedures; complete SOI of the Ft 1973 caseload by 51 December 
972; and implement fully the recommendation of the study and 
complete another SOI of tho FY 1972 caseload by 30 June 1973. 

(3) Progress and Shortfall 

A full accomplishment of this objective was 
achieved. During Ft 1973* I OS completed a total of 33,374 
cases of which 14*767 or 441 required field investigation. 

These figures compare with a total of 31,515 cases completed 
during FY 1972 of which 12*449 cases or 391 involved field 
investigations. 

Also during FY 1973, I0S expended 94,359 nan 
hours of operational support (equivalent to thirty-nine man 
years). This compares to 116*060 man hours of support for 
FY 1972 (equivalent to forty-nine man years). 
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The following illustrates the progress in terns 

of nilestones: 


Tt 1973 


30 September 1971: 

Completed study to streamline investigative techniques 
and procedures. 

31 December 1972: 

Completed 14,687 cases, including 65 SI cases 
involving field investigation. 

30 June 1973: _ , , ,, 

Completed an additional 18,657 cases, including 8216 
cases involving field investigation. 

As a result of the study to streamline investi- 
gative techniques and procedures, the following was accomplished: 

I 25X1 
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5. The only activity carried out under our information 
handling security program but not subsumed under a listed 
objective relates to the coordination of Office of Security 
plana and requirements for the application of ADP technology 
to Office opera t lone* In abort, this activity relates to the 
function of Inforaation Processing Coordination within the 
Office of Security. It includes coordinating support on the 
part of the Office for the MAP project and providing Office 
of Security input on natters and issues coordinated through 
the Agency Inforaation Processing Coordinator structure. 
Activities carried out in this aroa during FY 1973 were of a 
routine nature and no problems of great dimension **re 
encountered. The nost significant item anong these activities 
was the discussions in the final quarter of FY 1973 with 
reference to tho 000 propo sal to integrate the Security index 

25X1 (SANCA) into the DDO [___] System; this proposal was rejected 
eftor study by the Director of Security on the basis that 
current social pressures and the sensitivity of SANCA data 
supported its continued maintenance as an independent system. 

An estimated .25 man year during FY 1973 was involved in this 
coordination function. 

6. To render aefety support to ell Heedquerters end Field 
facilities on e doily basis and to participate in other 
activities required by law through reviewing plena end 
specifications for now construction end alterations; attendance 
at meetings of the Federal Safety and Pira Councils; reviewing 
shipping guides for heaardous materials; reviewing employee 
suggestions; conducting special teats for toxic vapors, noise 
levels, and illumination; briefing various components on the 
requirements of the Occupational Safety end Health Act; 
distributing safety literature; end responding to any problems 
relating to safety all without any increase in manpower. 

Dollar cost was $2,875 and man years expended were 3.77. 

7. To maintain and repair safekeeping equipment located 

in the Headquarters area with no increase la manpower. 3.75 
man years and $12,062 were expended. 
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g„ To provide security escort* to contractors and other 
workmen in Agency buildings in the Headquarter* * r J* ** 
ensure the security of our operatio ns and pre vent the loss or 

compromise of classified material. I 1 Program) 3/4 

staff man year, twelve full-time, ana tnirxy-nine part-time 
Contract Employees were utilised at a salary coat of $159,107. 


25X1 


9. To manufacture, issue, and control all Agency hedges 
and to issue and control all other forms of Agency credentials 
and identification, (3.5 man years and $12,035 were expended.) 


The Receptionist Section is responsible for the processing 
for* ra A«*ncv building*. Individual receptionists 


of visitors to Agency buildings. Individual receptionists 
are posted at selected building entrances where they register, 
identify, and badge visitors as spproprioto. hast year they 
handled 58,961 general visitors, 947 foreign nations!*, and 
5299 applicants. They processed 17,794 forgotten badges, 

7287 conference badges, and accepted 21,001 deliveries. In 
addition, the Section manned the collateral dork s office 
which processed 2229 traffic tickets. Sixteen nan years were 
expended. 


11. The Federal Protective Officers who serve as the guards 
for Agency buildings and grounds are employees of the General 
Services Administration. They are supervised by theiT ov» 
officers and noncommissioned officers but are responsible to 
the Director of Security in security matter# Mating to the 
protection of Agency assets. Within the Office of Security, 
the Building Security Branch is responsible for the interface 
between the FPO’i and the Director of Security. .2 of a man 

_ a -e _ ^ a waevl v mm iff* 


yoar of a staff employee* (Dollar cost of the yearly re _ _ 
bursement to 6SA based on hours worked in FT 1973 - $3,670,000.) 


12. The OS Special Security Center, in accordance with its 
charter, continued throughout FT 1073 providing various policy 
and support services to both the CIA and overall U.S. 
Intelligence community related to the security of compartment ed 
intelligence materials. Of special significance was the 
Center's increased emphasis on working with Federal civil 
departments and agencies due to the expanding use of compart- 
moated intelligence materials by such departments ^agencies. 

- ^ m ^ _ a ^ «AM*4«tn(<wm o»i ACM irfmllTinZt 


This matter is expected to require continuing close attention 
throughout FT 1974 to ensure protection of the sensitive Intel- 

^ * Amk AM elitnlflreyir 


ligence sources and methods involve 
services included: 1) security to 
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13. Significant accomplishments and activities of the 
Operational Support Division are set forth herein: 



25X1 


The Division received seventy request sf or «»***»»« 
through U.S. entry procedures and donesticair lineprocedures 
The assistance was provided Agency employees *J€orting 
sensitive equipment and foreign intelligence officials an 
trainees of interest to the Agency. The increase ow the 
previous year fro* thirty-nine to seventy is credited to the 
need to assist individuals on domestic and ^oreigndeparture 
and arrival flights, because of the use of anti-hijaching 
aagne tone ter devices by the U.S. air carriers. 
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During the Fiscal Year, escort support wee requested 
and provided on a routine or special basis on ninety- seven 
different occasions. The support was concerned with the 
sovement of classified material, funds and negotiable instru- 
ments for a variety of Agency conponennincluding the Office 
of Security Special Security Center I I Materials) , Office 
of Medical Services, Office of Finance, Central Cover Staff, 
Central Reference Service, and the Domestic Contact Service. 
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On seven occasions during the Fiscal Year 1973, 
was provided components of the Agency in the fora of 
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f. Surveillance 



I* Support to the OCX and the DPCI 

During the year, the Division received thirty-two 
assignments for support to the DC I and the DDCt. The assign* 
■ents consisted of a variety of activities in support of 
domestic and foreign travel, social functions, and official 
functions. 
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14. The Administration and Training Staff *J**Mrf fisejl, 
personnel . lo* 1st leal, and training sup J*»* ■ ***, ?" lc * ° 

Security during FT If 73a Men years 22. St total costs 

$429,698. 
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